Splunk® Enterprise

Getting Data In

Splunk Enterprise version 9.0 will no longer be supported as of June 14, 2024. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.

Share HEC Data

When you use HEC to collect data, the Splunk platform sends de-identified usage data ingested through HEC from Splunk add-ons, apps, and connectors to Splunk. This data is used to target pain points and improve functionality in future releases. For information about how this data is collected, stored, and governed, see Share data in Splunk Enterprise.

Types of data collected

deployment.httpEventCollector determines data usage by aggregating the following information:

Data collected Field name
The name of the add-on, app, or connector app
Number of bytes ingested bytes
The version of the add-on, app, or connector version

For example:

data: { [-]
app: stream333
bytes: 50
version: 3.1

Telemetry data for HEC is collected by default, and you can opt out of data sharing at any time. See How to opt out.

Components

HEC telemetry collects the following information:

Component Description Example
deployment.httpEventCollector Tracks the amount of data that is processed through HEC for an add-on, app, or connector.
{ [-]
app:
component: deployment.httpEventCollector
data: { [-]
app: stream333
bytes: 50
version: 3.1
}
deploymentID: 18393d55-3552-546c-a5ab-61a96a04ae04
eventID: 367E743C-D629-4B25-B46A-78447116F3A4
executionID: 319FB159-0B47-4CA0-B29D-4CD0EDDF0DCF
optInRequired: 1
timestamp: 1586974636
type: event
userID: 574f5debd4e54c49ef018a6e1bde0379df499a23a865ab83e8d23d1170256f40
visibility: [ [-]
anonymous
support
]
} 
Last modified on 31 August, 2020
Monitor Windows network information   Set up and use HTTP Event Collector in Splunk Web

This documentation applies to the following versions of Splunk® Enterprise: 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.0.4, 9.0.5, 9.0.6, 9.0.7, 9.0.8, 9.0.9, 9.0.10, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.1.6, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.3.0, 9.3.1


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters